Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:57
Static task
static1
Behavioral task
behavioral1
Sample
c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe
Resource
win10v2004-20240508-en
General
-
Target
c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe
-
Size
237KB
-
MD5
65bdf7cdcd49fd7b8df71924a75d42bf
-
SHA1
784b4d6f7e195e061cd8e258450514b6b180dc28
-
SHA256
c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7
-
SHA512
3669bcedfa34532b69cd5ec20551736ce54401e9491782a0ffd38c4b8bcbac67c4dc9483d432deb2f78a6bb8c46a86dcd7c439e8dee92bc6fc7c53faec3ad882
-
SSDEEP
6144:mA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:mATuTAnKGwUAWVycQqgj
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\166BDB80 = "C:\\Users\\Admin\\AppData\\Roaming\\166BDB80\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
winver.exepid process 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2756 winver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exewinver.exedescription pid process target process PID 292 wrote to memory of 2756 292 c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe winver.exe PID 292 wrote to memory of 2756 292 c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe winver.exe PID 292 wrote to memory of 2756 292 c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe winver.exe PID 292 wrote to memory of 2756 292 c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe winver.exe PID 292 wrote to memory of 2756 292 c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe winver.exe PID 2756 wrote to memory of 1124 2756 winver.exe Explorer.EXE PID 2756 wrote to memory of 1060 2756 winver.exe Dwm.exe PID 2756 wrote to memory of 1096 2756 winver.exe taskhost.exe PID 2756 wrote to memory of 1124 2756 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe"C:\Users\Admin\AppData\Local\Temp\c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/292-8-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1060-11-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/1060-23-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/1096-21-0x00000000020F0000-0x00000000020F6000-memory.dmpFilesize
24KB
-
memory/1096-14-0x00000000020F0000-0x00000000020F6000-memory.dmpFilesize
24KB
-
memory/1124-1-0x0000000002570000-0x0000000002576000-memory.dmpFilesize
24KB
-
memory/1124-6-0x0000000002570000-0x0000000002576000-memory.dmpFilesize
24KB
-
memory/1124-17-0x0000000002580000-0x0000000002586000-memory.dmpFilesize
24KB
-
memory/1124-3-0x0000000002570000-0x0000000002576000-memory.dmpFilesize
24KB
-
memory/1124-22-0x0000000002580000-0x0000000002586000-memory.dmpFilesize
24KB
-
memory/2756-20-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB
-
memory/2756-4-0x0000000000160000-0x0000000000166000-memory.dmpFilesize
24KB
-
memory/2756-25-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB